FAQ
Straight answers.
Common questions about what the lab does, how access works, and where the hard limits are.
Is this a public wallet-cracking service?
No. NUR Recovery Lab is a permissioned workspace for owner-held or otherwise authorized material. It does not offer arbitrary seed guessing, secp256k1 breaks, or third-party wallet attacks.
Can anyone create an account?
No. There is no public registration. An owner or administrator enrolls users with password + TOTP. See Access.
Which networks are supported?
Bitcoin, Ethereum, BNB Smart Chain, TRON, Litecoin, and Dogecoin for research and gated recovery tooling. Details: Networks.
What is Option B?
Option B calculates private keys directly from an authorized encrypted backup using the wallet password (BIP39 passphrase may be blank). It does not require a sealed verification job. Keys are revealed once for offline use.
What is Option A?
After a bounded password verification job seals a match, Option A unlocks calculate/export, discover funded keys, sweep, discover+sweep, and fee-bump. See Capabilities.
Why do research results say SIMULATED or RECORDED?
Those modes are intentional. LIVE means an approved provider answered. RECORDED means a packaged fixture. SIMULATED is an empty offline mock. The lab never labels fixtures as live balances.
Why is backup upload paused?
Intake follows runtime policy: the intake gate must be open, and production still expects backup/restore readiness (or an explicit owner waiver). Dashboard access can remain available while uploads are blocked.
Do I need MFA for every action?
Sign-in always requires password + TOTP. Privileged actions (exports, sweeps, sensitive settings, recovery-code rotation) additionally require a recent reauthentication window.
Which wallet formats work?
Supported families include Web3 Secret Storage v3, BIP39, Core SQLite/BDB inspection paths, Electrum JSON/BIE1, watch-xpub (addresses only), and lab synthetic fixtures. Hardware / BIE2 remain inspection-only. See Formats.
Can the lab move funds?
Only when fund-move gates are open, the case has authorization, MFA is fresh, and the operator initiates a sweep or fee-bump to a destination they control. Public marketing pages cannot broadcast transactions.
Are private keys stored in reports or audit logs?
Sanitized reports are permission-scoped and must not dump key material. Audit events record that privileged actions occurred; export designs aim for one-time reveal without writing secrets into audit payloads.
I lost my authenticator or password — what now?
Use account recovery with an unused offline recovery code if you still have the other factor. If both factors are lost, supervised recovery is required — emailing secrets will not help.
Where do I ask a human question?
Enrolled users: your workspace owner/admin. Public inquiries: Contact ([email protected]). Do not attach wallet secrets.
Still unsure?